Windows 11: Use after free in Windows Autopilot enables local privilege escalation

Summary

A use-after-free vulnerability (CWE-416) in the Windows Autopilot component of Windows 11 allows an authorized local user to elevate privileges. An attacker needs low-privileged local access, such as a standard user session or user-level malware, and the attack complexity is high. Successful exploitation can lead to full compromise of confidentiality, integrity and availability on the affected endpoint. No exploitation in the wild is confirmed in the sources.

Affected

• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711

Fixed in

• Cumulative update KB5127648 (released October 13, 2026) produces builds 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
• Whether KB5127648 explicitly lists this CVE could not be independently confirmed; verify in the MSRC entry
• Windows 11 24H2 Home and Pro reached end of servicing on October 13, 2026; KB5127648 is their final security update
• Fixes for other branches: Unknown.

Workaround

Unknown. No vendor workaround is known because a patch is available. Systems that cannot be patched should be treated as exposed.

Exploitation

• CISA SSVC assessment: exploitation none, automatable no, technical impact total
• Not listed in CISA KEV (per aggregator data)
• Exploit maturity: unproven (E:U)
• EPSS about 0.25% (low)
• Public proof of concept: none found; not confirmed absent

Our recommendation

• Install KB5127648 or a later cumulative update on all Windows 11 24H2, 25H2 and 26H2 devices in the normal monthly cycle; prioritize devices that accept untrusted users or files
• Plan migration of 24H2 Home and Pro devices to 25H2 or 26H2, as they no longer receive security updates
• Verify update compliance reports for Autopilot-enrolled devices
• Check the MSRC entry for the authoritative affected and fixed versions before updating change records
• Monitor for public exploit code and CISA KEV listing

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-108134 msrc.microsoft.com
• Microsoft KB5127648 security update (Windows 11 24H2, 25H2, 26H2) support.microsoft.com
• Vulners CVELIST record CVE-2026-108134 vulners.com
• Threat-intel record CVE-2026-108134 cve.threatint.com
• Strix CVE record CVE-2026-108134 www.strix.ai
• Notebookcheck: KB5127648 and Windows 11 lifecycle www.notebookcheck.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:45.